Soft switch using distributed firewalls for load sharing voice-over-IP traffic in an IP network

Abstract

A switch capable of handling voice-over-IP (VoIP) traffic between calling devices and called devices. The switch comprises: 1) call application nodes for executing call process server applications, wherein a first call process server application and a similar second call process server application form a first load sharing group server application; and 2) network address translation nodes for executing firewall server applications. A first firewall server application executed on a first network address translation node is associated with a similar second firewall server application executed on a second network address translation nodes separate from the first network address translation node. The first and second firewall server applications form a second load sharing group server application. The second load sharing group server application receives VoIP traffic and selects one of the first and second firewall server applications to verify that the VoIP traffic is authorized to access at least one of the call process server applications in the call application nodes according to a load distribution algorithm.

1. A switch capable of handling voice-over-IP (VoIP) traffic between calling devices and called devices, said switch comprising:
 a plurality of call application nodes capable of executing call process server applications, wherein a first call process server application is executed on a first one of said plurality of call application nodes and is associated with a similar second call process server application executed on a second one of said plurality of call application nodes separate from said first call application node, said first and second call process server applications thereby forming a first load sharing group server application; and 
 a plurality of network address translation nodes capable of executing firewall server applications, wherein a first firewall server application is executed on a first one of said plurality of network address translation nodes and is associated with a similar second firewall server application executed on a second one of said plurality of network address translation nodes separate from said first network address translation node, said first and second firewall server applications thereby forming a second load sharing group server application, wherein VoIP traffic associated with VoIP calls is received by said second load sharing group server application and said second load sharing group server application selects one of said first and second firewall server applications to verify that said VoIP traffic is authorized to access at least one of said call process server applications in said call application nodes according to a load distribution algorithm. 
 
   
   
     2. The switch as set forth in  claim 1  wherein said load distribution algorithm distributes said VoIP traffic in an alternating manner between said first and second firewall server applications. 
   
   
     3. The switch as set forth in  claim 1  wherein said load distribution algorithm distributes said VoIP traffic according to a current traffic load of said first firewall server application and a current traffic load of said second firewall server application. 
   
   
     4. The switch as set forth in  claim 3  wherein said load distribution algorithm distributes said VoIP traffic in order to maintain said current traffic load of said first firewall server application at a level substantially equal to said current traffic load of said second firewall server application. 
   
   
     5. The switch as set forth in  claim 1  wherein said first firewall server application comprises a first primary-backup group server application, wherein said first primary-backup group server application comprises a first primary firewall process executed on said first network address translation node and a first backup firewall process associated with said first primary firewall process. 
   
   
     6. The switch as set forth in  claim 5  wherein state information associated with said first primary firewall process is mirrored to said first backup firewall process associated with said first primary firewall process. 
   
   
     7. The switch as set forth in  claim 6  wherein said first backup firewall process resides on said first network address translation node. 
   
   
     8. The switch as set forth in  claim 6  wherein said first backup firewall process resides on a network address translation node separate from said first network address translation node. 
   
   
     9. The switch as set forth in  claim 1  wherein said second firewall server application comprises a second primary-backup group server application, wherein said second primary-backup group server application comprises a second primary firewall process executed on said second network address translation node and a second backup firewall process associated with said second primary firewall process. 
   
   
     10. The switch as set forth in  claim 9  wherein state information associated with said second primary firewall process is mirrored to said second backup firewall process associated with said second primary firewall process. 
   
   
     11. The switch as set forth in  claim 10  wherein said second backup firewall process resides on said second network address translation node. 
   
   
     12. The switch as set forth in  claim 10  wherein said second backup firewall process resides on a call application node separate from said second network address translation node. 
   
   
     13. A telecommunications network comprising:
 a plurality of switches capable of handling voice-over-IP (VoIP) traffic between calling devices and called devices, each of said plurality of switches comprising:
 a plurality of call application nodes capable of executing call process server applications, wherein a first call process server application is executed on a first one of said plurality of call application nodes and is associated with a similar second call process server application executed on a second one of said plurality of call application nodes separate from said first call application node, said first and second call process server applications thereby forming a first load sharing group server application; and 
 a plurality of network address translation nodes capable of executing firewall server applications, wherein a first firewall server application is executed on a first one of said plurality of network address translation nodes and is associated with a similar second firewall server application executed on a second one of said plurality of network address translation nodes separate from said first network address translation node, said first and second firewall server applications thereby forming a second load sharing group server application, wherein VoIP traffic associated with VoIP calls is received by said second load sharing group server application and said second load sharing group server application selects one of said first and second firewall server applications to verify that said VoIP traffic is authorized to access at least one of said call process server applications in said call application nodes according to a load distribution algorithm; and 
 an Internet protocol (IP) packet network for interconnecting said plurality of switches; and 
 at least one media gateway coupled to said IP packet network. 
 
 
   
   
     14. The telecommunications network as set forth in  claim 13  wherein said load distribution algorithm distributes said VoIP traffic in an alternating manner between said first and second firewall server applications. 
   
   
     15. The telecommunications network as set forth in  claim 13  wherein said load distribution algorithm distributes said VoIP traffic according to a current traffic load of said first firewall server application and a current traffic load of said second firewall server application. 
   
   
     16. The telecommunications network as set forth in  claim 15  wherein said load distribution algorithm distributes said VoIP traffic in order to maintain said current traffic load of said first firewall server application at a level substantially equal to said current traffic load of said second firewall server application. 
   
   
     17. The telecommunications network as set forth in  claim 13  wherein said first firewall server application comprises a first primary-backup group server application, wherein said first primary-backup group server application comprises a first primary firewall process executed on said first network address translation node and a first backup firewall process associated with said first primary firewall process. 
   
   
     18. The telecommunications network as set forth in  claim 17  wherein state information associated with said first primary firewall process is mirrored to said first backup firewall process associated with said first primary firewall process. 
   
   
     19. The telecommunications network as set forth in  claim 18  wherein said first backup firewall process resides on said first network address translation node. 
   
   
     20. The telecommunications network as set forth in  claim 18  wherein said first backup firewall process resides on a network address translation node separate from said first network address translation node. 
   
   
     21. The telecommunications network as set forth in  claim 13  wherein said second firewall server application comprises a second primary-backup group server application, wherein said second primary-backup group server application comprises a second primary firewall process executed on said second network address translation node and a second backup firewall process associated with said second primary firewall process. 
   
   
     22. The telecommunications network as set forth in  claim 21  wherein state information associated with said second primary firewall process is mirrored to said second backup firewall process associated with said second primary firewall process. 
   
   
     23. The telecommunications network as set forth in  claim 22  wherein said second backup firewall process resides on said second network address translation node. 
   
   
     24. The telecommunications network as set forth in  claim 22  wherein said second backup firewall process resides on a call application node separate from said second network address translation node.